.png){kind=icon}
.png){kind=icon}
Return
DelegateTracker: Delegatecall Vulnerability Detection Tool Based on Read-Write Data Flow Capture Algorithm
.png){kind=icon}
OA
AI
DOI：10.1016/j.bcra.2025.100338.png)
.png){kind=icon}
.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
Delegatecall vulnerability, as one of the most cunning vulnerabilities, has caused great trouble to the development of smart contracts. Aiming at the high false-positive rate of detection results of existing smart contract vulnerability detection tools and the irrationality of delegatecall by discarding, this paper innovatively proposes a delegatecall vulnerability detection tool DelegateTracker. It is based on the delegatecall vulnerability detection logic of the read-write data flow capture algorithm, and through the attack path search module to determine the execution path of the function that can modify the state variables in the called contract, to prove the necessary conditions for the existence of the vulnerability, and then through the attack path validation module to prove the sufficient conditions for the existence of the vulnerability, so as to discover the vulnerability. The tool not only successfully corroborates the existence of delegatecall vulnerabilities in Parity Wallet, but also discovers untriggered delegatecall vulnerabilities and their trigger paths among them. We used DelegateTracker to discover for the first time a caller contract with a delegatecall vulnerability on 1 existing public chain, outputting 3 attack paths with a value of 0.19 ETH. In addition, we use DelegateTracker to analyze 12,402 smart contracts for alerts when called by delegatecall, and find that 215 contracts have delegatecall vulnerabilities and output caller warning messages.
Keywords:
Smart Contract
Delegatecall
Symbolic Execution
Pattern Matching
AI Summary
Key information extracted from the uploaded paper, including a brief overview, abstract, background, key highlights, visual analysis, and future outlook.
Journal
IF:
5.6
Papers:
312
Citations:
754
Organization
No organization information available